Deadlock opportunity in gpg interaction code

DistUpgradeFetcher.py's DistUpgradeFetcher class's gpgauthenticate method uses the GnuPGInterface.GnuPG to check package signatures. It requests a stderr handle. Then it reads from the status handle and waits for the process to exit.

If the gnupg child process writes to stderr, these writes may fill the stderr buffer (rather easy to do, since stderr is a pipe) and then block. This will cause the process to never exit and the update-manager to hang indefinitely.

Another possibility is that the read() call on the status handle will never return, since the child process will never exit or otherwise close the status file descriptor, and so the Python read call will wait indefinitely so that it can return all bytes from the file.

status and stderr should be read from non-blockingly, or an event notification mechanism (eg select) should be used to read from each whenever it presents data, and only once each is closed should wait be called.